Recommended action
Review before promotingMixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.
Block this release in CIcurl · GitHub Actions
Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.
curl -fsS https://pkgradar.com/gate/npm \
-H "Authorization: Bearer $PKGRADAR_TOKEN" \
-H "Content-Type: application/json" \
-d '{"specs":["[email protected]"],"fail_on":"review"}'GitHub Actions step:
- name: PkgRadar gate
run: |
curl -fsS https://pkgradar.com/gate/npm \
-H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
-H "Content-Type: application/json" \
-d '{"specs":["[email protected]"],"fail_on":"review"}'Why flagged
What the scanner saw
Known Indicator Filename: package/dist/lib/bundle.js
Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.
Availability ledger
available
Status history (1 event)
- new → available · risk review · score 174 · status changed
Evidence
Static findings
44 static · 0 from release diff · showing high-signal first.
| Severity | Kind | Path | Detail | Points |
|---|---|---|---|---|
| high | Known Indicator Filename | package/dist/lib/bundle.js | package/dist/lib/bundle.js | 45 |
| medium | Obfuscation Density | package/dist-bundle/web/assets/chunk-727SXJPM-Dgiqi2fO.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/dist-bundle/web/assets/flowDiagram-I6XJVG4X-CbMNHcpV.js | high encoded/escaped-token density | 12 |
Show all 44 findings (low-signal and informational)
| Severity | Kind | Path | Detail | Points |
|---|---|---|---|---|
| high | Known Indicator Filename | package/dist/lib/bundle.js | package/dist/lib/bundle.js | 45 |
| medium | Obfuscation Density | package/dist-bundle/web/assets/chunk-727SXJPM-Dgiqi2fO.js | high encoded/escaped-token density | 12 |
| medium | Obfuscation Density | package/dist-bundle/web/assets/flowDiagram-I6XJVG4X-CbMNHcpV.js | high encoded/escaped-token density | 12 |
| low | Credential file access | package/dist-bundle/web/assets/ssh-config-_ykCGR6B.js | matched ".ssh" | 5 |
| low | Obfuscation | package/dist-bundle/web/assets/ara-BRHolxvo.js | matched "\\x7F" | 3 |
| low | Obfuscation | package/dist-bundle/web/assets/blade-2xfisSek.js | matched "\\x7F" | 3 |
| low | Obfuscation | package/dist-bundle/web/assets/blockDiagram-GPEHLZMM-BQTKoJrp.js | matched "\\u000D" | 3 |
| low | Obfuscation | package/dist-bundle/web/assets/c4Diagram-AAUBKEIU-DbzEB8SA.js | matched "eVal(" | 3 |
| low | Obfuscation | package/dist-bundle/web/assets/chunk-727SXJPM-Dgiqi2fO.js | matched "\\u00AA" | 3 |
| low | Obfuscation | package/dist-bundle/web/assets/coffee-Ch7k5sss.js | matched "fromCharCode" | 3 |
| low | Obfuscation | package/dist-bundle/web/assets/crystal-DGywbUpC.js | matched "\\x08" | 3 |
| low | Obfuscation | package/dist-bundle/web/assets/css-CLj8gQPS.js | matched "\\uFEFF" | 3 |
| low | Obfuscation | package/dist-bundle/web/assets/cytoscape.esm-BHYC38rz.js | matched "\\u200b" | 3 |
| low | Obfuscation | package/dist/commands/doctor.js | matched "\\x1b" | 3 |
| low | Obfuscation | package/dist-bundle/web/assets/erDiagram-TEJ5UH35-CfontV_K.js | matched "\\u00C0" | 3 |
| low | Obfuscation | package/dist-bundle/web/assets/flowDiagram-I6XJVG4X-CbMNHcpV.js | matched "\\u00AA" | 3 |
| low | Obfuscation | package/dist-bundle/web/assets/glimmer-js-ByusRIyA.js | matched "\\x08" | 3 |
| low | Obfuscation | package/dist-bundle/web/assets/glimmer-ts-BfAWNZQY.js | matched "\\x08" | 3 |
| low | Obfuscation | package/dist-bundle/web/assets/hack-DbPARsA_.js | matched "\\x7F" | 3 |
| low | Obfuscation | package/dist-bundle/web/assets/html-pp8916En.js | matched "\\x00" | 3 |
| low | Obfuscation | package/dist-bundle/web/assets/index-Bse6oThM.js | matched "\\u00C0" | 3 |
| low | Obfuscation | package/dist-bundle/web/assets/index-DzSXo8Hy.js | matched "\\u2028" | 3 |
| low | Obfuscation | package/dist-bundle/web/assets/journeyDiagram-JHISSGLW-BlEGUN50.js | matched "eVal(" | 3 |
| low | Obfuscation | package/dist-bundle/web/assets/julia-D7OTSIA_.js | matched "\\x01" | 3 |
| low | Obfuscation | package/dist-bundle/web/assets/katex-BTI-AXqd.js | matched "\\x00" | 3 |
| low | Obfuscation | package/dist-bundle/web/assets/katex-C5jXJg4s.js | matched "\\x00" | 3 |
| low | Obfuscation | package/dist-bundle/web/assets/less-B1dDrJ26.js | matched "\\x00" | 3 |
| low | Obfuscation | package/dist-bundle/web/assets/mermaid.core-BDlJIfVk.js | matched "\\x1B" | 3 |
| low | Obfuscation | package/dist-bundle/server/extensions/parse-plugins.js | matched "fromCharCode" | 3 |
| low | Obfuscation | package/dist-bundle/server/extensions/parse-skills.js | matched "fromCharCode" | 3 |
| low | Obfuscation | package/dist-bundle/web/assets/php-Csjmro_R.js | matched "\\x7F" | 3 |
| low | Obfuscation | package/dist-bundle/web/assets/puppet-BMWR74SV.js | matched "\\x7F" | 3 |
| low | Obfuscation | package/dist-bundle/web/assets/quadrantDiagram-W4KKPZXB-FhbvHg5n.js | matched "\\x00" | 3 |
| low | Obfuscation | package/dist-bundle/web/assets/ruby-DyJCeAvU.js | matched "\\x00" | 3 |
| low | Obfuscation | package/dist-bundle/web/assets/sankeyDiagram-5OEKKPKP-AzwVD9EQ.js | matched "\\u000D" | 3 |
| low | Obfuscation | package/dist-bundle/web/assets/scss-D5BDwBP9.js | matched "\\x00" | 3 |
| low | Obfuscation | package/dist-bundle/web/assets/sequenceDiagram-3UESZ5HK-Db6KmIzT.js | matched "eVal(" | 3 |
| low | Obfuscation | package/dist-bundle/web/assets/stata-DI20mbqo.js | matched "\\x00" | 3 |
| low | Obfuscation | package/dist-bundle/web/assets/stylus-BEDo0Tqx.js | matched "\\x00" | 3 |
| low | Obfuscation | package/dist-bundle/web/assets/twig-CW1WmMYd.js | matched "\\x7F" | 3 |
| low | Obfuscation | package/dist-bundle/web/assets/typst-DHCkPAjA.js | matched "\\x00" | 3 |
| low | Obfuscation | package/dist-bundle/web/assets/vue-D2xRrEX4.js | matched "\\x00" | 3 |
| low | Obfuscation | package/dist-bundle/web/assets/wardley-L42UT6IY-CMdDhGCS.js | matched "\\u2028" | 3 |
| low | Obfuscation | package/dist-bundle/web/assets/wasm-CG6Dc4jp.js | matched "atob(" | 3 |
Manifest
Package metadata
Scripts3
buildtsc && node ../../scripts/build-cli-bundle.mjsprepublishOnlypnpm buildtypechecktsc --noEmit
Dependencies7
@agentclientprotocol/sdk^0.22.1@fastify/static^8.0.4@fastify/websocket^11.0.2better-sqlite3^12.10.0chokidar^5.0.0fastify^5.1.0open^10.1.0